Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1251381 > unrolled thread

Bug#1108474: qt6-base: CVE-2025-5455

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1108474: qt6-base: CVE-2025-5455 Moritz Mühlenhoff <jmm@inutil.org> - 2025-06-29 14:10 +0200

#1251381 — Bug#1108474: qt6-base: CVE-2025-5455

Package: qt6-base
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for qt6-base.

CVE-2025-5455[0]:
| An issue was found in the private API function qDecodeDataUrl() in
| QtCore, which is used in QTextDocument and QNetworkReply, and,
| potentially, in user code.  If the function was called with
| malformed data, for example, an URL that contained a "charset"
| parameter that lacked a value (such as "data:charset,"), and Qt was
| built with assertions enabled, then it would hit an assertion,
| resulting in a denial of service (abort).  This impacts Qt up to
| 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed
| in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

https://codereview.qt-project.org/c/qt/qtbase/+/642006
	 

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-5455
    https://www.cve.org/CVERecord?id=CVE-2025-5455

Please adjust the affected versions in the BTS as needed.

[toc] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web